Sync namespace resources between Git and Kestra at regular intervals

Keep a Kestra namespace continuously in sync with a Git repository so your version-controlled flows, scripts, and dashboards become the single source of truth. This blueprint runs a scheduled, unidirectional GitOps sync that pulls the latest committed namespace resources from Git into Kestra every 15 minutes, eliminating manual deployments and configuration drift between your repository and your running instance.

How it works

• A io.kestra.plugin.core.trigger.Schedule trigger named every_15_minutes fires on the cron expression */15 * * * *, launching the flow four times an hour.
• The sync task of type io.kestra.plugin.git.NamespaceSync clones the configured Git repository and reconciles its contents into the target namespace.
• sourceOfTruth is set to GIT, so Git always wins: whatever is committed in the repository defines the desired state of the namespace.
• whenMissingInSource is set to DELETE, meaning resources removed from Git are also removed from Kestra, keeping the namespace clean.
• protectedNamespaces lists system, guarding critical resources from accidental deletion during reconciliation.
• The task reads from branch: main under gitDirectory: example_directory of the repository at the configured url, authenticating with username and password.

What you get

• Automatic, hands-off deployment of flows, namespace files, and dashboards from Git.
• A clean reconciliation model where deletions in Git propagate to Kestra.
• Protection for system namespaces so reconciliation never touches critical internals.
• A predictable 15 minute cadence that you can tighten or loosen with one cron edit.

Who it's for

• Platform and DevOps teams standardizing Kestra deployments on GitOps.
• Data engineers who want code review and pull requests to gate what reaches production.
• Teams running multiple environments that need repeatable, auditable promotion of resources.

Why orchestrate this with Kestra

Git itself has no scheduler and no awareness of your Kestra instance, so a commit does nothing until something pulls and applies it. Kestra closes that gap: the Schedule trigger drives the pull on a fixed cadence, retries handle transient clone or network failures, and every sync run is recorded with full execution lineage and logs for audit. The entire pipeline is declarative YAML, so the deployment process is itself version-controlled, reviewable, and reproducible across environments.

Prerequisites

• A Kestra instance with access to the target Git repository.
• A Git repository containing the namespace resources you want to deploy.

Secrets

• GITHUB_USERNAME: the Git account or service user used to authenticate.
• GITHUB_ACCESS_TOKEN: a personal access token with read access to the repository.

Quick start

1. Add the GITHUB_USERNAME and GITHUB_ACCESS_TOKEN secrets to your Kestra instance.
2. Replace url, gitDirectory, and branch with your repository details.
3. Set the target namespace on the sync task to the namespace you want to manage.
4. Add the flow to Kestra and let the every_15_minutes trigger reconcile on schedule.

How to extend

• Adjust the cron expression to sync more or less frequently, or replace the schedule with a webhook trigger for push-based deploys.
• Add more entries to protectedNamespaces to shield additional critical namespaces.
• Change whenMissingInSource to KEEP if you prefer additive syncs that never delete.
• Chain a notification task after sync to alert a channel when a deployment lands.

Links

• plugin-git documentation
• Git orchestration with Kestra